CVE-2022-23206: vulnerability in Apache Traffic Control
Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 2.0%
In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach.
Affected products
Apache Software Foundation · Apache Traffic ControlRelated CVEs — Apache Traffic Control
In the same product, most dangerous first.
CVE-2024-45387CRITICALApache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_commentsEPSS 66.1%CVE-2021-43350—LDAP filter injection vulnerability in Traffic OpsEPSS 4.8%CVE-2017-7670—CVE-2017-7670EPSS 4.7%CVE-2021-42009—Apache Traffic Control Traffic Ops Email Injection VulnerabilityEPSS 2.8%CVE-2025-61581HIGHApache Traffic Control: ReDoS issue in Traffic Router configurationEPSS 0.7%